public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Chore: Update authlib (foder as top level argument) (#111800)

Browse Source
This commit is contained in:
Ryan McKinley
2025-10-01 14:40:28 +00:00
committed by GitHub
parent 3541926e5c
commit 2f2289f226
61 changed files with 181 additions and 178 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/aggregator/go.mod
+1 -1
View File
@@ -153,7 +153,7 @@ require (
google.golang.org/genproto/googleapis/api v0.0.0-20250908214217-97024824d090 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 // indirect
google.golang.org/grpc v1.75.1 // indirect
google.golang.org/protobuf v1.36.8 // indirect
google.golang.org/protobuf v1.36.9 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
pkg/aggregator/go.sum
+2 -2
View File
@@ -445,8 +445,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090/go.
google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
pkg/apimachinery/go.mod
+3 -3
View File
@@ -3,8 +3,8 @@ module github.com/grafana/grafana/pkg/apimachinery
go 1.24.6
require (
github.com/grafana/authlib v0.0.0-20250924100039-ea07223cdb6c // @grafana/identity-access-team
github.com/grafana/authlib/types v0.0.0-20250917093142-83a502239781 // @grafana/identity-access-team
github.com/grafana/authlib v0.0.0-20250930082137-a40e2c2b094f // @grafana/identity-access-team
github.com/grafana/authlib/types v0.0.0-20250926065801-df98203cff37 // @grafana/identity-access-team
github.com/stretchr/testify v1.11.1
gopkg.in/yaml.v3 v3.0.1
k8s.io/apimachinery v0.34.1
@@ -51,7 +51,7 @@ require (
golang.org/x/text v0.29.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 // indirect
google.golang.org/grpc v1.75.1 // indirect
google.golang.org/protobuf v1.36.8 // indirect
google.golang.org/protobuf v1.36.9 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
pkg/apimachinery/go.sum
+6 -6
View File
@@ -30,10 +30,10 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/grafana/authlib v0.0.0-20250924100039-ea07223cdb6c h1:8GIMe1KclDdfogaeRsiU69Ev2zTF9kmjqjQqqZMzerc=
github.com/grafana/authlib v0.0.0-20250924100039-ea07223cdb6c/go.mod h1:C6CmTG6vfiqebjJswKsc6zes+1F/OtTCi6aAtL5Um6A=
github.com/grafana/authlib/types v0.0.0-20250917093142-83a502239781 h1:jymmOFIWnW26DeUjFgYEoltI170KeT5r1rI8a/dUf0E=
github.com/grafana/authlib/types v0.0.0-20250917093142-83a502239781/go.mod h1:qeWYbnWzaYGl88JlL9+DsP1GT2Cudm58rLtx13fKZdw=
github.com/grafana/authlib v0.0.0-20250930082137-a40e2c2b094f h1:Cbm6OKkOcJ+7CSZsGsEJzktC/SIa5bxVeYKQLuYK86o=
github.com/grafana/authlib v0.0.0-20250930082137-a40e2c2b094f/go.mod h1:axY0cdOg3q0TZHwpHnIz5x16xZ8ZBxJHShsSHHXcHQg=
github.com/grafana/authlib/types v0.0.0-20250926065801-df98203cff37 h1:qEwZ+7MbPjzRvTi31iT9w7NBhKIpKwZrFbYmOZLqkwA=
github.com/grafana/authlib/types v0.0.0-20250926065801-df98203cff37/go.mod h1:qeWYbnWzaYGl88JlL9+DsP1GT2Cudm58rLtx13fKZdw=
github.com/grafana/dskit v0.0.0-20250908063411-6b6da59b5cc4 h1:jSojuc7njleS3UOz223WDlXOinmuLAIPI0z2vtq8EgI=
github.com/grafana/dskit v0.0.0-20250908063411-6b6da59b5cc4/go.mod h1:VahT+GtfQIM+o8ht2StR6J9g+Ef+C2Vokh5uuSmOD/4=
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
@@ -132,8 +132,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 h1:
google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090/go.mod h1:GmFNa4BdJZ2a8G+wCe9Bg3wwThLrJun751XstdJt5Og=
google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
pkg/apiserver/go.mod
+3 -3
View File
@@ -4,7 +4,7 @@ go 1.24.6
require (
github.com/google/go-cmp v0.7.0
github.com/grafana/authlib/types v0.0.0-20250917093142-83a502239781
github.com/grafana/authlib/types v0.0.0-20250926065801-df98203cff37
github.com/grafana/grafana-app-sdk/logging v0.45.0
github.com/grafana/grafana/pkg/apimachinery v0.0.0-20250514132646-acbc7b54ed9e
github.com/prometheus/client_golang v1.23.2
@@ -44,7 +44,7 @@ require (
github.com/google/gnostic-models v0.7.0 // indirect
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/grafana/authlib v0.0.0-20250924100039-ea07223cdb6c // indirect
github.com/grafana/authlib v0.0.0-20250930082137-a40e2c2b094f // indirect
github.com/grafana/dskit v0.0.0-20250908063411-6b6da59b5cc4 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 // indirect
@@ -95,7 +95,7 @@ require (
google.golang.org/genproto/googleapis/api v0.0.0-20250908214217-97024824d090 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 // indirect
google.golang.org/grpc v1.75.1 // indirect
google.golang.org/protobuf v1.36.8 // indirect
google.golang.org/protobuf v1.36.9 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
pkg/apiserver/go.sum
+6 -6
View File
@@ -63,10 +63,10 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
github.com/grafana/authlib v0.0.0-20250924100039-ea07223cdb6c h1:8GIMe1KclDdfogaeRsiU69Ev2zTF9kmjqjQqqZMzerc=
github.com/grafana/authlib v0.0.0-20250924100039-ea07223cdb6c/go.mod h1:C6CmTG6vfiqebjJswKsc6zes+1F/OtTCi6aAtL5Um6A=
github.com/grafana/authlib/types v0.0.0-20250917093142-83a502239781 h1:jymmOFIWnW26DeUjFgYEoltI170KeT5r1rI8a/dUf0E=
github.com/grafana/authlib/types v0.0.0-20250917093142-83a502239781/go.mod h1:qeWYbnWzaYGl88JlL9+DsP1GT2Cudm58rLtx13fKZdw=
github.com/grafana/authlib v0.0.0-20250930082137-a40e2c2b094f h1:Cbm6OKkOcJ+7CSZsGsEJzktC/SIa5bxVeYKQLuYK86o=
github.com/grafana/authlib v0.0.0-20250930082137-a40e2c2b094f/go.mod h1:axY0cdOg3q0TZHwpHnIz5x16xZ8ZBxJHShsSHHXcHQg=
github.com/grafana/authlib/types v0.0.0-20250926065801-df98203cff37 h1:qEwZ+7MbPjzRvTi31iT9w7NBhKIpKwZrFbYmOZLqkwA=
github.com/grafana/authlib/types v0.0.0-20250926065801-df98203cff37/go.mod h1:qeWYbnWzaYGl88JlL9+DsP1GT2Cudm58rLtx13fKZdw=
github.com/grafana/dskit v0.0.0-20250908063411-6b6da59b5cc4 h1:jSojuc7njleS3UOz223WDlXOinmuLAIPI0z2vtq8EgI=
github.com/grafana/dskit v0.0.0-20250908063411-6b6da59b5cc4/go.mod h1:VahT+GtfQIM+o8ht2StR6J9g+Ef+C2Vokh5uuSmOD/4=
github.com/grafana/grafana-app-sdk/logging v0.45.0 h1:0SH6nYZpiLBZRwUq4J6+1vo8xuHKJjnO95/2pGOoA8w=
@@ -265,8 +265,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090/go.
google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
pkg/build/go.mod
+1 -1
View File
@@ -17,7 +17,7 @@ require (
golang.org/x/sync v0.17.0 // @grafana/alerting-backend
golang.org/x/text v0.29.0 // indirect; @grafana/grafana-backend-group
google.golang.org/grpc v1.75.1 // indirect; @grafana/plugins-platform-backend
google.golang.org/protobuf v1.36.8 // indirect; @grafana/plugins-platform-backend
google.golang.org/protobuf v1.36.9 // indirect; @grafana/plugins-platform-backend
)
require (
pkg/build/go.sum
+2 -2
View File
@@ -111,8 +111,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 h1:
google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090/go.mod h1:GmFNa4BdJZ2a8G+wCe9Bg3wwThLrJun751XstdJt5Og=
google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
pkg/promlib/go.mod
+1 -1
View File
@@ -12,7 +12,7 @@ require (
github.com/stretchr/testify v1.11.1
go.opentelemetry.io/otel v1.38.0
go.opentelemetry.io/otel/trace v1.38.0
google.golang.org/protobuf v1.36.8
google.golang.org/protobuf v1.36.9
k8s.io/apimachinery v0.34.1
)
pkg/promlib/go.sum
+2 -2
View File
@@ -420,8 +420,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 h1:
google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090/go.mod h1:GmFNa4BdJZ2a8G+wCe9Bg3wwThLrJun751XstdJt5Og=
google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
pkg/registry/apis/folders/sub_access.go
+1 -2
View File
@@ -87,8 +87,7 @@ func (r *subAccessREST) getAccessInfo(ctx context.Context, name string) (*folder
Resource: foldersV1.RESOURCE,
Namespace: ns.Value,
Name: name,
Folder: obj.GetFolder(),
})
}, obj.GetFolder())
return tmp.Allowed
}
pkg/registry/apis/provisioning/register.go
+1 -1
View File
@@ -287,7 +287,7 @@ func (b *APIBuilder) GetAuthorizer() authorizer.Authorizer {
Name: a.GetName(),
Namespace: a.GetNamespace(),
Subresource: a.GetSubresource(),
})
}, "")
if err != nil {
return authorizer.DecisionDeny, "failed to perform authorization", err
}
pkg/registry/apis/provisioning/resources/dualwriter.go
+1 -2
View File
@@ -515,9 +515,8 @@ func (r *DualReadWriter) authorize(ctx context.Context, parsed *ParsedResource,
Resource: parsed.GVR.Resource,
Namespace: id.GetNamespace(),
Name: name,
Folder: parsed.Meta.GetFolder(),
Verb: verb,
})
}, parsed.Meta.GetFolder())
if err != nil || !rsp.Allowed {
return apierrors.NewForbidden(parsed.GVR.GroupResource(), parsed.Obj.GetName(),
fmt.Errorf("no access to read the embedded file"))
pkg/registry/apis/secret/inline/inline_secure_value.go
+1 -1
View File
@@ -142,7 +142,7 @@ func (s *LocalInlineSecureValueService) canIdentityReadSecureValue(ctx context.C
Resource: secretv1beta1.SecureValuesResourceInfo.GroupResource().Resource,
Namespace: namespace.String(),
Name: name,
})
}, "")
if err != nil {
return fmt.Errorf("checking access for secure value %s: %w", name, err)
}
pkg/services/accesscontrol/authorizer.go
+4 -1
View File
@@ -85,7 +85,7 @@ type LegacyAccessClient struct {
opts map[string]ResourceAuthorizerOptions
}
func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest) (claims.CheckResponse, error) {
func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest, folder string) (claims.CheckResponse, error) {
ident, ok := id.(identity.Requester)
if !ok {
return claims.CheckResponse{}, errors.New("expected identity.Requester for legacy access control")
@@ -140,6 +140,9 @@ func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req
return claims.CheckResponse{}, err
}
// NOTE: folder is looked up again in the evaluator:
// pkg/services/accesscontrol/acimpl/accesscontrol.go#L77
return claims.CheckResponse{Allowed: allowed}, nil
}
pkg/services/accesscontrol/authorizer_test.go
+6 -6
View File
@@ -24,7 +24,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Resource: "dashboards",
Namespace: "default",
Name: "1",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, false, res.Allowed)
})
@@ -47,7 +47,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Namespace: "default",
Resource: "dashboards",
Name: "1",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, false, res.Allowed)
@@ -70,7 +70,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Verb: "list",
Namespace: "default",
Resource: "dashboards",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, true, res.Allowed)
@@ -94,7 +94,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Namespace: "default",
Resource: "dashboards",
Name: "1",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, true, res.Allowed)
@@ -119,7 +119,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Namespace: "default",
Resource: "dashboards",
Name: "1",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, true, res.Allowed)
@@ -129,7 +129,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Namespace: "default",
Resource: "dashboards",
Name: "1",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, false, res.Allowed)
pkg/services/apiserver/auth/authorizer/resource.go
+1 -1
View File
@@ -36,7 +36,7 @@ func (r ResourceAuthorizer) Authorize(ctx context.Context, attr authorizer.Attri
Name: attr.GetName(),
Subresource: attr.GetSubresource(),
Path: attr.GetPath(),
})
}, "") // NOTE: we do not know the folder in this context
if err != nil {
return authorizer.DecisionDeny, "", err
pkg/services/authz/zanzana/client/client.go
+5 -4
View File
@@ -3,11 +3,12 @@ package client
import (
"context"
"go.opentelemetry.io/otel"
"google.golang.org/grpc"
authzlib "github.com/grafana/authlib/authz"
authzv1 "github.com/grafana/authlib/authz/proto/v1"
authlib "github.com/grafana/authlib/types"
"go.opentelemetry.io/otel"
"google.golang.org/grpc"
"github.com/grafana/grafana/pkg/infra/log"
authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
@@ -36,11 +37,11 @@ func New(cc grpc.ClientConnInterface) (*Client, error) {
return c, nil
}
func (c *Client) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest) (authlib.CheckResponse, error) {
func (c *Client) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest, folder string) (authlib.CheckResponse, error) {
ctx, span := tracer.Start(ctx, "authlib.zanzana.client.Check")
defer span.End()
return c.authzlibclient.Check(ctx, id, req)
return c.authzlibclient.Check(ctx, id, req, folder)
}
func (c *Client) Compile(ctx context.Context, id authlib.AuthInfo, req authlib.ListRequest) (authlib.ItemChecker, authlib.Zookie, error) {
pkg/services/authz/zanzana/client/noop.go
+1 -1
View File
@@ -16,7 +16,7 @@ func NewNoop() *NoopClient {
type NoopClient struct{}
func (nc *NoopClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest) (authlib.CheckResponse, error) {
func (nc *NoopClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest, folder string) (authlib.CheckResponse, error) {
return authlib.CheckResponse{}, nil
}
pkg/services/authz/zanzana/client/shadow_client.go
+4 -4
View File
@@ -3,9 +3,9 @@ package client
import (
"context"
authlib "github.com/grafana/authlib/types"
"github.com/prometheus/client_golang/prometheus"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/log"
)
@@ -29,7 +29,7 @@ func WithShadowClient(accessClient authlib.AccessClient, zanzanaClient authlib.A
return client
}
func (c *ShadowClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest) (authlib.CheckResponse, error) {
func (c *ShadowClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest, folder string) (authlib.CheckResponse, error) {
acResChan := make(chan authlib.CheckResponse, 1)
acErrChan := make(chan error, 1)
@@ -42,7 +42,7 @@ func (c *ShadowClient) Check(ctx context.Context, id authlib.AuthInfo, req authl
defer timer.ObserveDuration()
zanzanaCtx := context.WithoutCancel(ctx)
res, err := c.zanzanaClient.Check(zanzanaCtx, id, req)
res, err := c.zanzanaClient.Check(zanzanaCtx, id, req, folder)
if err != nil {
c.logger.Error("Failed to run zanzana check", "error", err)
}
@@ -61,7 +61,7 @@ func (c *ShadowClient) Check(ctx context.Context, id authlib.AuthInfo, req authl
}()
timer := prometheus.NewTimer(c.metrics.evaluationsSeconds.WithLabelValues("rbac"))
res, err := c.accessClient.Check(ctx, id, req)
res, err := c.accessClient.Check(ctx, id, req, folder)
timer.ObserveDuration()
acResChan <- res
acErrChan <- err
pkg/services/authz/zanzana/zanzana.go
+1 -3
View File
@@ -7,7 +7,6 @@ import (
openfgav1 "github.com/openfga/api/proto/openfga/v1"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/authz/zanzana/common"
)
@@ -123,7 +122,7 @@ func MergeFolderResourceTuples(a, b *openfgav1.TupleKey) {
va.GetListValue().Values = append(va.GetListValue().Values, vb.GetListValue().Values...)
}
func TranslateToCheckRequest(namespace, action, kind, folder, name string) (*authlib.CheckRequest, bool) {
func TranslateToCheckRequest(namespace, action, kind, name string) (*authlib.CheckRequest, bool) {
translation, ok := resourceTranslations[kind]
if !ok {
@@ -146,7 +145,6 @@ func TranslateToCheckRequest(namespace, action, kind, folder, name string) (*aut
Group: translation.group,
Resource: translation.resource,
Name: name,
Folder: folder,
}
return req, true
pkg/services/dashboards/database/database.go
+3 -1
View File
@@ -18,6 +18,7 @@ import (
"github.com/grafana/grafana/pkg/services/dashboards"
dashver "github.com/grafana/grafana/pkg/services/dashboardversion"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/folder"
"github.com/grafana/grafana/pkg/services/libraryelements/model"
"github.com/grafana/grafana/pkg/services/quota"
"github.com/grafana/grafana/pkg/services/sqlstore"
@@ -96,6 +97,7 @@ func (d *dashboardStore) GetDashboardsByLibraryPanelUID(ctx context.Context, lib
return connectedDashboards, err
}
// nolint:gocyclo
func (d *dashboardStore) ValidateDashboardBeforeSave(ctx context.Context, dash *dashboards.Dashboard, overwrite bool) (bool, error) {
ctx, span := tracer.Start(ctx, "dashboards.database.ValidateDashboardBeforesave")
defer span.End()
@@ -107,7 +109,7 @@ func (d *dashboardStore) ValidateDashboardBeforeSave(ctx context.Context, dash *
// we don't save FolderID in kubernetes object when saving through k8s
// this block guarantees we save dashboards with folder_id and folder_uid in those cases
if !dash.IsFolder && dash.FolderUID != "" && dash.FolderID == 0 { // nolint:staticcheck
if !dash.IsFolder && dash.FolderUID != "" && dash.FolderID == 0 && dash.FolderUID != folder.GeneralFolderUID { // nolint:staticcheck
var existing dashboards.Dashboard
folderIdFound, err := sess.Where("uid=? AND org_id=?", dash.FolderUID, dash.OrgID).Get(&existing)
if err != nil {
pkg/storage/unified/resource/access.go
+3 -3
View File
@@ -107,7 +107,7 @@ func NewAuthzLimitedClient(client claims.AccessClient, opts AuthzOptions) claims
}
// Check implements claims.AccessClient.
func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest) (claims.CheckResponse, error) {
func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest, folder string) (claims.CheckResponse, error) {
t := time.Now()
ctx, span := c.tracer.Start(ctx, "authzLimitedClient.Check", trace.WithAttributes(
attribute.String("group", req.Group),
@@ -115,7 +115,7 @@ func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req c
attribute.String("namespace", req.Namespace),
attribute.String("name", req.Name),
attribute.String("verb", req.Verb),
attribute.String("folder", req.Folder),
attribute.String("folder", folder),
attribute.Bool("fallback_used", FallbackUsed(ctx)),
))
defer span.End()
@@ -145,7 +145,7 @@ func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req c
span.SetAttributes(attribute.Bool("allowed", true))
return claims.CheckResponse{Allowed: true}, nil
}
resp, err := c.client.Check(ctx, id, req)
resp, err := c.client.Check(ctx, id, req, folder)
if err != nil {
c.logger.Error("Check", "group", req.Group, "resource", req.Resource, "error", err, "duration", time.Since(t), "traceid", trace.SpanContextFromContext(ctx).TraceID().String())
c.metrics.errorsTotal.WithLabelValues(req.Group, req.Resource, req.Verb).Inc()
pkg/storage/unified/resource/access_test.go
+3 -3
View File
@@ -34,7 +34,7 @@ func TestAuthzLimitedClient_Check(t *testing.T) {
Verb: utils.VerbGet,
Namespace: "stacks-1",
}
resp, err := client.Check(context.Background(), &identity.StaticRequester{Namespace: "stacks-1"}, req)
resp, err := client.Check(context.Background(), &identity.StaticRequester{Namespace: "stacks-1"}, req, "")
assert.NoError(t, err)
assert.Equal(t, test.expected, resp.Allowed)
}
@@ -135,7 +135,7 @@ func TestNamespaceMatching(t *testing.T) {
// Create a mock auth info with the specified namespace
// Test Check method
user := &identity.StaticRequester{Namespace: tt.authNamespace}
_, checkErr := client.Check(ctx, user, checkReq)
_, checkErr := client.Check(ctx, user, checkReq, "")
// Test Compile method
compileReq := authlib.ListRequest{
@@ -199,7 +199,7 @@ func TestNamespaceMatchingFallback(t *testing.T) {
// Create a mock auth info with the specified namespace
// Test Check method
user := &identity.StaticRequester{Namespace: tt.authNamespace}
_, checkErr := client.Check(ctx, user, checkReq)
_, checkErr := client.Check(ctx, user, checkReq, "")
// Test Compile method
compileReq := authlib.ListRequest{
pkg/storage/unified/resource/bulk.go
+1 -1
View File
@@ -190,7 +190,7 @@ func (s *server) BulkProcess(stream resourcepb.BulkStore_BulkProcessServer) erro
Group: k.Group,
Resource: k.Resource,
Verb: utils.VerbDeleteCollection,
})
}, "")
if err != nil || !rsp.Allowed {
return sendAndClose(&resourcepb.BulkResponse{
Error: &resourcepb.ErrorResult{
pkg/storage/unified/resource/server.go
+6 -15
View File
@@ -22,7 +22,6 @@ import (
claims "github.com/grafana/authlib/types"
"github.com/grafana/dskit/backoff"
"github.com/grafana/grafana/pkg/apimachinery/utils"
"github.com/grafana/grafana/pkg/apimachinery/validation"
secrets "github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
@@ -558,8 +557,7 @@ func (s *server) newEvent(ctx context.Context, user claims.AuthInfo, key *resour
check.Name = key.Name
}
check.Folder = obj.GetFolder()
a, err := s.access.Check(ctx, user, check)
a, err := s.access.Check(ctx, user, check, obj.GetFolder())
if err != nil {
return nil, AsErrorResult(err)
}
@@ -596,10 +594,9 @@ func (s *server) checkFolderMovePermissions(ctx context.Context, user claims.Aut
Resource: key.Resource,
Namespace: key.Namespace,
Name: key.Name,
Folder: oldFolder,
}
a, err := s.access.Check(ctx, user, updateCheck)
a, err := s.access.Check(ctx, user, updateCheck, oldFolder)
if err != nil {
return AsErrorResult(err)
}
@@ -616,10 +613,10 @@ func (s *server) checkFolderMovePermissions(ctx context.Context, user claims.Aut
Group: key.Group,
Resource: key.Resource,
Namespace: key.Namespace,
Folder: newFolder,
Name: key.Name,
}
a, err = s.access.Check(ctx, user, createCheck)
a, err = s.access.Check(ctx, user, createCheck, newFolder)
if err != nil {
return AsErrorResult(err)
}
@@ -809,8 +806,7 @@ func (s *server) delete(ctx context.Context, user claims.AuthInfo, req *resource
Resource: req.Key.Resource,
Namespace: req.Key.Namespace,
Name: req.Key.Name,
Folder: latest.Folder,
})
}, latest.Folder)
if err != nil {
rsp.Error = AsErrorResult(err)
return rsp, nil
@@ -876,10 +872,6 @@ func (s *server) Read(ctx context.Context, req *resourcepb.ReadRequest) (*resour
}}, nil
}
// if req.Key.Group == "" {
// status, _ := AsErrorResult(apierrors.NewBadRequest("missing group"))
// return &ReadResponse{Status: status}, nil
// }
if req.Key.Resource == "" {
return &resourcepb.ReadResponse{Error: NewBadRequestError("missing resource")}, nil
}
@@ -912,8 +904,7 @@ func (s *server) read(ctx context.Context, user claims.AuthInfo, req *resourcepb
Resource: req.Key.Resource,
Namespace: req.Key.Namespace,
Name: req.Key.Name,
Folder: rsp.Folder,
})
}, rsp.Folder)
if err != nil {
return &resourcepb.ReadResponse{Error: AsErrorResult(err)}, nil
}
pkg/storage/unified/search/bleve_test.go
+3 -2
View File
@@ -15,7 +15,6 @@ import (
"time"
"github.com/blevesearch/bleve/v2"
authlib "github.com/grafana/authlib/types"
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/testutil"
"github.com/stretchr/testify/assert"
@@ -23,6 +22,8 @@ import (
"go.uber.org/atomic"
"go.uber.org/goleak"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/apimachinery/utils"
"github.com/grafana/grafana/pkg/infra/log/logtest"
@@ -652,7 +653,7 @@ type StubAccessClient struct {
resourceResponses map[string]bool // key is the resource name, and bool if what the checker will return
}
func (nc *StubAccessClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest) (authlib.CheckResponse, error) {
func (nc *StubAccessClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest, folder string) (authlib.CheckResponse, error) {
return authlib.CheckResponse{Allowed: nc.resourceResponses[req.Resource]}, nil
}
pkg/storage/unified/testing/server.go
+17 -9
View File
@@ -125,12 +125,15 @@ func runTestResourcePermissionScenarios(t *testing.T, backend resource.StorageBa
resourceUID := fmt.Sprintf("test123-%d", i)
// Create a mock access client with the test case's permission map
checksPerformed := []types.CheckRequest{}
checksPerformed := []CheckRequestEX{}
mockAccess := &mockAccessClient{
allowed: false, // Default to false
allowedMap: tc.permissionMap,
checkFn: func(req types.CheckRequest) {
checksPerformed = append(checksPerformed, req)
checkFn: func(req types.CheckRequest, folder string) {
checksPerformed = append(checksPerformed, CheckRequestEX{
CheckRequest: req,
Folder: folder,
})
},
}
@@ -167,7 +170,7 @@ func runTestResourcePermissionScenarios(t *testing.T, backend resource.StorageBa
}
}`, resourceName, resourceUID, nsPrefix+"-ns1", tc.initialFolder, i)
checksPerformed = []types.CheckRequest{}
checksPerformed = []CheckRequestEX{}
created, err := server.Create(ctx, &resourcepb.CreateRequest{
Value: []byte(resourceJSON),
Key: key,
@@ -232,7 +235,7 @@ func runTestResourcePermissionScenarios(t *testing.T, backend resource.StorageBa
}`, resourceName, resourceUID, nsPrefix+"-ns1", tc.targetFolder, i)
mockAccess.allowed = false // Reset to use the map
checksPerformed = []types.CheckRequest{}
checksPerformed = []CheckRequestEX{}
updated, err := server.Update(ctx, &resourcepb.UpdateRequest{
Key: key,
@@ -494,18 +497,18 @@ func runTestListTrashAccessControl(t *testing.T, backend resource.StorageBackend
type mockAccessClient struct {
allowed bool
allowedMap map[string]bool
checkFn func(types.CheckRequest)
checkFn func(types.CheckRequest, string)
compileFn func(user types.AuthInfo, req types.ListRequest) types.ItemChecker
}
func (m *mockAccessClient) Check(ctx context.Context, user types.AuthInfo, req types.CheckRequest) (types.CheckResponse, error) {
func (m *mockAccessClient) Check(ctx context.Context, user types.AuthInfo, req types.CheckRequest, folder string) (types.CheckResponse, error) {
if m.checkFn != nil {
m.checkFn(req)
m.checkFn(req, folder)
}
// Check specific folder:verb mappings if provided
if m.allowedMap != nil {
key := fmt.Sprintf("%s:%s", req.Folder, req.Verb)
key := fmt.Sprintf("%s:%s", folder, req.Verb)
if allowed, exists := m.allowedMap[key]; exists {
return types.CheckResponse{Allowed: allowed}, nil
}
@@ -526,3 +529,8 @@ func (m *mockAccessClient) Compile(ctx context.Context, user types.AuthInfo, req
return m.allowed
}, types.NoopZookie{}, nil
}
type CheckRequestEX struct {
types.CheckRequest
Folder string
}
pkg/tests/apis/dashboard/dashboards_test.go
+4 -5
View File
@@ -15,6 +15,10 @@ import (
"k8s.io/client-go/dynamic"
k8srest "k8s.io/client-go/rest"
dashboardV0 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v0alpha1"
dashboardV1 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v1beta1"
dashboardV2alpha1 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v2alpha1"
dashboardV2beta1 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v2beta1"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/apimachinery/utils"
"github.com/grafana/grafana/pkg/apiserver/rest"
@@ -24,11 +28,6 @@ import (
"github.com/grafana/grafana/pkg/tests/apis"
"github.com/grafana/grafana/pkg/tests/testinfra"
"github.com/grafana/grafana/pkg/tests/testsuite"
dashboardV0 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v0alpha1"
dashboardV1 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v1beta1"
dashboardV2alpha1 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v2alpha1"
dashboardV2beta1 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v2beta1"
"github.com/grafana/grafana/pkg/util/testutil"
)
pkg/tests/apis/folder/folders_test.go
+3 -4
View File
@@ -10,24 +10,23 @@ import (
"testing"
"time"
"github.com/prometheus/common/model"
"github.com/stretchr/testify/require"
"k8s.io/apimachinery/pkg/api/meta"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
"k8s.io/apimachinery/pkg/runtime/schema"
"github.com/grafana/grafana/pkg/expr"
apimodels "github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
"github.com/prometheus/common/model"
folders "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
"github.com/grafana/grafana/pkg/api/dtos"
grafanarest "github.com/grafana/grafana/pkg/apiserver/rest"
"github.com/grafana/grafana/pkg/expr"
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/folder"
apimodels "github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/setting"